Custom TLS CAs and client certificates were not supported in Private Cloud until recently.
But in the latest release (Mendix Operator version 1.7.0 and Gateway Agent 1.6.0), client certificates are now fully supported: https://docs.mendix.com/releasenotes/developer-portal/mendix-for-private-cloud#december-10th-2020